libsoup CVE-2026-15713

Exploitation requires the target application to use libsoup's HTTP/2 implementation and accept HTTP/2 connections from untrusted network peers. The vulnerability is triggered by specific stream termination conditions: either HTTP/2 flow control window exhaustion or explicit RST_STREAM frames sent by the attacker. The CVSS AC:H rating and SSVC 'Automatable: no' designation indicate the attacker must sustain a crafted sequence of protocol interactions over time rather than executing a single-packet exploit - this limits opportunistic, automated mass exploitation. No authentication is required (PR:N), so any network-reachable HTTP/2 endpoint is theoretically in scope. Exploitation impact is limited to the process running libsoup (S:U, unchanged scope) and requires sustained attacker patience; a one-time connection will not trigger the crash. HTTP/1.x-only configurations are not affected as the flaw is specific to HTTP/2 stream management.

Multiple signals converge on a moderate real-world risk profile. The CVSS base score of 5.9 reflects AV:N (network reachable) and PR:N (no authentication), but AC:H indicates the attacker must engineer specific protocol conditions rather than send a single malformed packet - this is confirmed by SSVC's 'Automatable: no' designation, meaning scripted mass exploitation is not straightforward. EPSS at 0.35% (27th percentile) is low, suggesting the broader security community does not currently assess high near-term exploitation likelihood. SSVC Technical Impact is rated 'partial', consistent with a DoS-only scenario. CISA has not listed this in KEV, and no public exploit code has been identified. A critical data quality issue must be flagged: the provided CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N assigns C:H (high confidentiality impact) with A:N (no availability impact), which directly contradicts the description of an OOM denial-of-service with no mention of data disclosure. Mathematically both C:H/A:N and C:N/A:H yield the same 5.9 score, suggesting a data entry transposition error. Defenders should treat this as an Availability-impacting vulnerability (DoS) rather than a confidentiality breach, and verify with the Red Hat advisory. Overall, prioritize patching for internet-facing libsoup deployments; the risk is not critical but is exploitable without credentials by a patient attacker.

An attacker repeatedly establishes HTTP/2 connections to a server using libsoup, deliberately triggering stream terminations via flow control window exhaustion or RST_STREAM frames to cause stream context memory to be allocated but never freed. Over a sustained period - potentially hours - the accumulating leaked allocations exhaust available heap, causing the libsoup-based application to crash with an out-of-memory error. No exploit code has been publicly identified, and the AC:H rating indicates the attacker must carefully engineer the protocol interaction rather than use a simple one-shot payload.